CVE-2018-1000156 affecting package patch for versions less than 2.7.6-7

CVE-2018-1000156 affecting package patch for versions less than 2.7.6-7. A patched version of the package is available...

CVE-2018-6951 affecting package patch for versions less than 2.7.6-7

CVE-2018-6951 affecting package patch for versions less than 2.7.6-7. A patched version of the package is available...

CVE-2018-20969 affecting package patch for versions less than 2.7.6-7

CVE-2018-20969 affecting package patch for versions less than 2.7.6-7. A patched version of the package is available...

CVE-2018-6952 affecting package patch for versions less than 2.7.6-7

CVE-2018-6952 affecting package patch for versions less than 2.7.6-7. A patched version of the package is available...

CVE-2018-13410 affecting package zip for versions less than 3.0-5

CVE-2018-13410 affecting package zip for versions less than 3.0-5. A patched version of the package is available...

Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is vulnerable to spoofing and clickjacking attacks due to swagger-ui (CVE-2018-25031, CVE-2021-46708)

Summary IBM WebSphere Application Server Liberty for IBM i contains swagger-ui which is vulnerable to spoofing and clickjacking attacks as described in the vulnerability details section. IBM WebSphere Application Server Liberty for IBM i has addressed the vulnerabilities with a fix that upgrades...

SUSE: Security Advisory (SUSE-SU-2022:1129-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

QNAP QTS / QuTS hero Insufficient HTTP Security Headers (QSA-21-03)

The version of QNAP QTS or QuTS hero on the remote host is affected by a vulnerability involving insufficient HTTP security headers. This vulnerability allows remote attackers to launch privacy and security attacks. Note that Nessus has not tested for this issue but has instead relied only on the...

Amazon Linux 2 : zlib (ALAS-2022-1772)

The version of zlib installed on the remote host is prior to 1.2.7-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1772 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has...

Roxy File Manager 1.4.5 PHP File Upload Restriction Bypass Exploit

Roxy File Manager version 1.4.5 proof of concept exploit for a PHP file upload restriction bypass vulnerability. Exploit Title: Roxy File Manager 1.4.5 PHP File Upload Restriction Bypass Exploit Author: Adam Shebani NULLHE4D Software: Roxy File Manager Version: 1.4.5 CVE: CVE-2018-20525 Vendor...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to spoofing attacks and clickjacking due to swagger-ui (CVE-2018-25031, CVE-2021-46708)

Summary There are multiple vulnerabilities in the swagger-ui library used by IBM WebSphere Application Server Liberty with mpOpenAPI-1.0, mpOpenAPI-1.1, mpOpenAPI-2.0, mpOpenAPI-3.0, openapi-3.0 or the openapi-3.1 feature enabled. These vulnerabilities could allow spoofing attacks or clickjacking...

CLSA-2022-1649170583 Fix CVE(s): CVE-2018-25032

SECURITY UPDATE: memory corruption when deflating - debian/patches/CVE-2018-25032-1.patch: fix a bug that can crash deflate on some input when using ZFIXED in deflate.c, deflate.h. - debian/patches/CVE-2018-25032-2.patch: assure that the number of bits for deflatePrime is valid in deflate.c. -...

Security advisory: Recently reported zlib compression issue impacts Qt

zlib has recently reported that it has a security issue when deflating which could cause memory corruption if the input has many distant matches. This is reported in a bit more detail here: and has been assigned the CVE id CVE-2018-25032. This has been fixed in an update to zlib 1.2.12 This affec...

SUSE SLED12 / SLES12 Security Update : yaml-cpp (SUSE-SU-2022:1072-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1072-1 advisory. - CVE-2018-20573: Fixed remote DOS via a crafted YAML file in function Scanner:EnsureTokensInQueue bsc1121227....

Roxy File Manager 1.4.5 PHP File Upload Restriction Bypass

Exploit Title: Roxy File Manager 1.4.5 PHP File Upload Restriction Bypass Exploit Author: Adam Shebani NULLHE4D Date: 07/03/2022 Software: Roxy File Manager Version: 1.4.5 CVE: CVE-2018-20525 Vendor Homepage: http://www.roxyfileman.com/ Software Link:...

SUSE SLED15 / SLES15 Security Update : yaml-cpp (SUSE-SU-2022:1073-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1073-1 advisory. - CVE-2018-20573: Fixed remote DOS via a crafted YAML file in function Scanner:EnsureTokensInQueue bsc1121227....

OpenSSH < 8.0

According to its banner, the version of OpenSSH running on the remote host is prior to 8.0. It is, therefore, affected by the following vulnerabilities: - A permission bypass vulnerability due to improper directory name validation. An unauthenticated, remote attacker can exploit this, with a...

Debian DLA-2968-1 : zlib - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2968 advisory. - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches. CVE-2018-25032 Note that Nessus has not tested fo...

LG N1A1 Remote Code Execution (CVE-2018-14839)

A remote code execution vulnerability exists in LG N1A1. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

openSUSE: Security Advisory for yaml-cpp (openSUSE-SU-2022:1073-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...